{"uuid": "8bf59235-354e-431b-b6a8-cd53da06cc8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "title": "A contradictory timeline", "description": "August 21, 2026. CVSS 10.0. Deserialization. Microsoft patched a remote code execution vulnerability in Entra ID, its cloud identity service \u2014 and told customers to do nothing. The flaw, CVE-2026-69836, is rated CVSS 10.0, the maximum score, and stems from the deserialization of untrusted data that let an unauthenticated attacker execute code over the network.\n\nThe line to remember is not technical. It sits in Microsoft\u2019s advisory: \u201cThis vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.\u201d An invisible patch, for a flaw nobody can verify.\n\n**The flaw at the heart of identity**\n\nEntra ID \u2014 formerly Azure Active Directory \u2014 is the service that authenticates logins and controls access to Microsoft 365, Azure, and thousands of connected third-party apps. It is the central identity component at the vast majority of enterprises.\n\nDeserialization of untrusted data means the application turns serialized, attacker-controlled input back into live objects or code structures, without sufficient validation. Here the consequence is the gravest possible: an unauthenticated attacker can execute code inside the identity service itself.\n\nThe flaw was discovered by Robert Fitzpatrick, a Microsoft principal security engineer. The vector is remote, account-free, and interaction-free \u2014 the triplet that justifies the 10.0.\n\n\n**A contradictory timeline**\n\nThe public record is murkier than the advisory suggests. Help Net Security first reported the flaw as \u201cexploited in the wild\u201d, before Microsoft corrected an \u201cExploited\u201d flag attached to the CVE. The result: the vulnerability is not in CISA\u2019s KEV, the reference list of actively exploited flaws.\n\nThat back-and-forth matters. A withdrawn \u201cexploited\u201d flag, an absence from the KEV, and a patch \u201calready applied\u201d server-side leave a CISO with no independent way to know whether exploitation actually happened, or for how long.\n\nMicrosoft has not disclosed who was behind any exploitation, when it began, how many organizations were affected, or what attackers did once inside the service. The \u201cfurther transparency\u201d stops at the statement itself.\n\n\n**The opacity of the cloud patch**\n\nThis is the core point. A server-side patch on a multi-tenant service you do not deploy is, by nature, invisible: no binary to download, no version to check, no reboot to schedule. You cannot confirm the fix is in place other than by trusting the vendor.\n\nThat opacity inverts the balance of traditional security. On an on-premise product, you control the patch; on a cloud service, you control only your signals \u2014 sign-in logs, audits, permission changes. Your defense perimeter shifts from patching to detection.\n\nIt is also a lesson in shared responsibility. Microsoft patches the service; you patch what the service cannot patch for you: accounts, roles, conditional access, and monitoring.", "description_format": "markdown", "vulnerability": "CVE-2026-69836", "creation_timestamp": "2026-09-09T19:39:32.531672+00:00", "timestamp": "2026-09-09T19:39:32.530474+00:00", "related_vulnerabilities": ["CVE-2026-69836"], "meta": [{"ref": ["https://ettayeb.fr/en/security/entra-id-rce-cve-2026-69836/"]}], "author": {"login": "cedric", "name": "C\u00e9dric Bonhomme", "uuid": "af0120d0-3dac-4a6a-974b-a9f33d2a9846"}}